Home Malware Programs Trojans TSPY_ZBOT.SMD

TSPY_ZBOT.SMD

Posted: May 24, 2013

Threat Metric

Ranking: 7,569
Threat Level: 9/10
Infected PCs: 2,089
First Seen: May 24, 2013
Last Seen: October 11, 2023
OS(es) Affected: Windows

TSPY_ZBOT.SMD is a Trojan with spyware capabilities that strives to steal sensitive online banking information, such as user names and passwords. TSPY_ZBOT.SMD sets an affected PC user's account information at risk and uses the stolen data without the victim's authorization. TSPY_ZBOT.SMD strives to get information from a list of banks or financial institutions. TSPY_ZBOT.SMD checks for the existence of the processes 'outpost.exe' and 'zlclient.exe', which are linked to Outpost Personal Firewall and ZoneLabs Firewall Client. TSPY_ZBOT.SMD terminates if either of the processes exist to assure that it loads uninterrupted. TSPY_ZBOT.SMD also contains rootkit capabilities, which permits it to conceal its processes and files from the PC user. TSPY_ZBOT.SMD may be downloaded from the remote websites. TSPY_ZBOT.SMD drops the copies of itself into the infected computer system. TSPY_ZBOT.SMD inserts itself into the processes 'SVCHOST.EXE' and 'WINLOGON.EXE' as part of its memory residency routine. TSPY_ZBOT.SMD modifies the registry entries to allow its automatic execution every time the computer system is started. TSPY_ZBOT.SMD adds the registry entries as part of its installation routine. TSPY_ZBOT.SMD also creates the registry entries to bypass Windows Firewall.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%System%\sdra64.exe File name: %System%\sdra64.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\lowsec\user.ds File name: %System%\lowsec\user.ds
Mime Type: unknown/ds
Group: Malware file
Loading...